hxxps://charlessturt[.]my[.]site[.]com/s/login

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://charlessturt.my.site.com/s/login
Sample260729-sakecsab34

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298105317475102"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{6FFE8F66-81A2-40FC-A923-25B2C674B1C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2428	1960	msedge.exe	85
PID 1960 wrote to memory of 4516	1960	msedge.exe	87
PID 1960 wrote to memory of 2368	1960	msedge.exe	86
PID 1960 wrote to memory of 4516	1960	msedge.exe	87
PID 1960 wrote to memory of 4516	1960	msedge.exe	87
PID 1960 wrote to memory of 4540	1960	msedge.exe	88
PID 1960 wrote to memory of 4540	1960	msedge.exe	88
PID 1960 wrote to memory of 2572	1960	msedge.exe	90
PID 1960 wrote to memory of 2572	1960	msedge.exe	90
PID 1960 wrote to memory of 4664	1960	msedge.exe	91
PID 1960 wrote to memory of 2572	1960	msedge.exe	90
PID 1960 wrote to memory of 4664	1960	msedge.exe	91
PID 1960 wrote to memory of 4664	1960	msedge.exe	91
PID 1960 wrote to memory of 3360	1960	msedge.exe	92
PID 1960 wrote to memory of 4816	1960	msedge.exe	93
PID 1960 wrote to memory of 3360	1960	msedge.exe	92
PID 1960 wrote to memory of 3360	1960	msedge.exe	92
PID 1960 wrote to memory of 4816	1960	msedge.exe	93
PID 1960 wrote to memory of 4816	1960	msedge.exe	93
PID 1960 wrote to memory of 3500	1960	msedge.exe	98
PID 1960 wrote to memory of 3500	1960	msedge.exe	98
PID 1960 wrote to memory of 464	1960	msedge.exe	99
PID 1960 wrote to memory of 464	1960	msedge.exe	99
PID 1960 wrote to memory of 2112	1960	msedge.exe	101
PID 1960 wrote to memory of 4452	1960	msedge.exe	103
PID 1960 wrote to memory of 4452	1960	msedge.exe	103
PID 1960 wrote to memory of 4452	1960	msedge.exe	103
PID 1960 wrote to memory of 3588	1960	msedge.exe	113
PID 1960 wrote to memory of 3588	1960	msedge.exe	113
PID 1960 wrote to memory of 4428	1960	msedge.exe	117
PID 1960 wrote to memory of 4428	1960	msedge.exe	117
PID 1960 wrote to memory of 4428	1960	msedge.exe	117
PID 1960 wrote to memory of 4768	1960	msedge.exe	120
PID 1960 wrote to memory of 5076	1960	msedge.exe	121
PID 1960 wrote to memory of 2692	1960	msedge.exe	122
PID 1960 wrote to memory of 1940	1960	msedge.exe	123
PID 1960 wrote to memory of 1940	1960	msedge.exe	123
PID 1960 wrote to memory of 1940	1960	msedge.exe	123
PID 1960 wrote to memory of 4152	1960	msedge.exe	124
PID 1960 wrote to memory of 4152	1960	msedge.exe	124
PID 1960 wrote to memory of 4152	1960	msedge.exe	124
PID 1960 wrote to memory of 4924	1960	msedge.exe	126
PID 1960 wrote to memory of 4924	1960	msedge.exe	126
PID 1960 wrote to memory of 4924	1960	msedge.exe	126
PID 1960 wrote to memory of 3816	1960	msedge.exe	127
PID 1960 wrote to memory of 3816	1960	msedge.exe	127
PID 1960 wrote to memory of 3628	1960	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://charlessturt.my.site.com/s/login
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ff92ed0c188,0x7ff92ed0c194,0x7ff92ed0c1a0
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,2166775275955120754,10424171623567322166,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14368808678565009483,9084231055328690942,262144 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,9851964274467895745,11246886887642956465,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16484411772647629506,6269434755918948653,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2906000227336612467,9637275570367001448,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7007572902387968173,13013247109682306890,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6525559341597684473,1552305243112604128,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5639940747337953278,278138908282744600,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,1055805772195831276,3274602309601383347,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8585732775008199113,10580200580170641090,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8585732775008199113,10580200580170641090,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5036,i,8421507281096659991,10967096970893555291,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9173979512700238271,527354599657384919,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6044,i,325894028416380484,11978003389241253842,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,15848811560661005497,14397966310267239539,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,1985697725047757970,103470631379655806,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,10561165040688889091,3366076008454412120,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3556,i,1410503244711617303,13507411600273522112,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4348,i,1919730270774702913,988620741008317459,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3604,i,8604620598368037164,8461623740212901303,2097152 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,15442926454059272434,9575072729486260884,524288 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,14071773652336938272,18315143106051192848,262144 --field-trial-handle=2256,i,3820898479158059452,11751123956032860110,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2c09ee46b7c965cad5a46c37758e11db13a1d0c10cc1f11c2d56a66b03aa9d8b
MD5 eaad5de67696a6a017987d0d3625171f
SHA1 fd6abd2ec81c5b4289311c572fd14899fadc01db
SHA512 8f91b88f0550ad5e464e946fbd15abd752d93f0ca17ad11a1370af100204170c260fb5eaeeafe44cb5c8e12d67aa64b4aea0c2733e54a2e3787ac3d023e34186
SSDEEP 48:/a80yKM4UPAUQZfnOwJTtysyx6XZACvMdlV7wtZVW1P1m9XBoW11pEdSXuy7Eulg:lI6PAbDrnSb26aBou4SR7Bl52P7
TLSH
T1979152B6115142ADFB5100B1A8F79BE3B570E8FEF5BF0F1D8010583E1DB1B93081561A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593c05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593c05.TMP
Size 3KB
SHA256 9a6bb36f857fafb07a59b9fa52e4313f92e1878e65700fa726d16878fd4ed5a6
MD5 ed03f72001aed35145900d63072a7d79
SHA1 c4642086bf10846feda3a051259205c03be3f79a
SHA512 d3f89729bcdb878566cb1b26fb45157e4c15ac7e4f9fdd2adbf150053df948dcb46d3006641150c170e94d0eadc07d700a1b348cea2970974464681b67e99b8a
TLSH
T1FD8119B6225242A8FB9001B1E9FB9AD2F071E8FEF5BF0F5E8150487E4D30393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_charlessturt.my.site.com_0.indexeddb.leveldb\000003.log
Size 797KB
SHA256 0d8e308e750c9afdf72779945e6c62e5f275d9ffd4521fb123edefb4a7bd2555
MD5 60dedcdea68565dc9a0c37570adf270e
SHA1 58c359bf8fe9364240d3376a429cb49c0b9454bb
SHA512 434ef30134c2db4e5b838e3b02ab2711344bd79daa580c3b321d99634b72ad337401bd45b26ef1cc099b3e4e0fd83f25b91523e90e60b410b24770587058bb9c
SSDEEP 24576:zq0tg8aHV0zvqZlhapbjoq0KmGK/iumoLjNomoZX/:zq0t+0ziMjttm1/tjOX/
TLSH
T17D05CE0B16E44542FAB64E78AAF26797A9777D827C70CD0DA0CD732C4B33A019971B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_charlessturt.my.site.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_charlessturt.my.site.com_0.indexeddb.leveldb\LOG
Size 371B
SHA256 a434552391c316690939205f4b7dda8685e519d678dc4d75654bdf2cc1a0a722
MD5 6ec37b19071c89509860332e4cb0c644
SHA1 7d6eb60ec568a6038fe339f5c796ef3ea2638ab8
SHA512 3be7ffa13cdda6709c78f9137fef969a8db9984b77f223ffbf1bd50f5c55db63f7dc48b1fdb17355df01f342cefeeffb70c2d73fc5496aeefe42276781270d0e
TLSH
T1BCE0612C84C9C22B9614519B0539774EB273651FE7C87D4D0F84CD10B54704594FE741
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_charlessturt.my.site.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

9df6de02-609b-4a9e-8d1e-d9d9873fedee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9df6de02-609b-4a9e-8d1e-d9d9873fedee.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 07f7848a6bbf8d177aad8c8fea70ed64f64e487a1f27d663f4d4f3e51f0da12d
MD5 1def843dfd69585ed9d9cd549dba5a83
SHA1 0460d81ff40df3a0faf11b5fd47a8f3bd9ab2e0f
SHA512 efc8a7a0ad5b7319d3f185176ed33b4fc5566fd1a399f7a640a1d92699c9e9403b47e414455c1ba06fbd34f198a7d97c2043a9a3f29232c5c53585eeaf35c5e2
SSDEEP 96:DEOfwMfHf3fYf7z9/z9uzrftfKfq4f2f6fCfNWfnBfOuw3z99fbC:DPfjfHf3fYf7p/pu/ftfKfq4f2f6fCfu
TLSH
T1F79179F7C3E4C66E99515AF0AA247E17CE1E0555832C3C0685E4EF5B93F2071E282A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 de85fb4d3e23ca31d7f6108c6844158804a6f2e86f2ccbcc30a4fcd5a8762ecf
MD5 8ccee9be95450fc96b06b432d802c876
SHA1 a096d634580e4faec1c4daffa260f4ff4754e8b5
SHA512 166c987c21b28642b19480302590c41bc704e633349323976e8bc7805246a1ec50671f3e92d6614dbbde47f8e5965a529604eeb825fb1c7e8907576539c35e56
SSDEEP 192:sxZCRhyM/jK1Ml8MkU/fdsAS6VqIdpXoHW6+WNqpW/YvAajD9IgrJ:sxZCdMU/fdsASy4Hbr/OF9
TLSH
T1F842E612AA349977CCDBD609B941BF53D6F94462D2900E44AEFCCB1C04E7AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6ce93a527b90ad36778539b623e30805d909271336864165ed74ef0dca7db152
MD5 d3091a6787eca1c0b6896c635c604067
SHA1 028aa7cdd6d3a2d0f4705e23187df907eafac5cf
SHA512 f0516b921d6935ff5ea7c91b697c40a3c25a94c1be9696443341e41354912d2de50b46059fca6b19d998495107ebcfd51565a66688e8b16fcc765521fe4afd5c
SSDEEP 192:sxZCRhyM/jK1Ml8M9U/fdsKvqVqIdpu/yAPHW6+WNzroRJ5XYvR+jD9Ig5/J:sxZCf1U/fdsKvi0Hbz8JXFFf
TLSH
T17652D616AA345AB7CCDBD609B941BF53D6F54462D2904E44AEFCCB1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82e32363132046eaa6ad8f14184ba95b74d0d0a2c98e99878887899f73dfb901
MD5 c61e03e5beba7be8bbde023c5249e9a7
SHA1 1eeaaf45b8d786ada52f4cff013f0dc7d5e59466
SHA512 e47270e8bb936e560bfd7009a303218ea7ab70247b9227a5a06153da39fab520e75fd06f3c2977db9639b89d8d8ea1e143e7c62cca327ed5860f0763c9abd63a
SSDEEP 192:sxZCRhyM/jK1Ml8M9U/fdsKS6VqIdpXoHW6+WNqJ5XYvsajD9Ig5VJ:sxZCd1U/fdsKSy4HbIX2FJ
TLSH
T1FC52D616AA345977CCDBD609FA45BF93D6F94462D2900E44AAFCCB1C04E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2ea4ac60ca12b7f664b433b896b7d6dbe1185d593af9e1cff9e6908c7d6dfad
MD5 d448b80849194292e1f5dd5e6b473a51
SHA1 eb91527f3dfcdb49060dbef65fe72074661a208b
SHA512 ab1f244ab1ebe95fe6be134bfe13752399dc480973bffd05848ea28172e1ca99b598e96d68a1e7e4c2f92ef1a96efe31ba3205ef2d5f133f277f76ebaa61435c
SSDEEP 192:sxZCRhyM/jK1Ml8UQz9U/fdsKvqVqIdp4/yAPHW6+WNzroRJ5XYvRljD9Ig5/J:sxZCfqBU/fdsKvi6Hbz8JXiFf
TLSH
T17452D556AA345AB7CCDBD609F941BF93D6F54462D2904E44AAFCCB1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e8858804e52bd6eaa402d3a2bc07800a9ce86eb00bcd032c011990775fd31e0d
MD5 f25fe4c780e9b74caaf4dea24f2d998f
SHA1 94a8f3d4f2882628f7afc4d09ca26feed1fad199
SHA512 155f2af6b0597306c0cbf4841eec00bb411a58fcf0bd0a498ab2b7b8e694c58b75c608495762f435c148e13d95e30ad8913b576755914e40d3783cb4f45c8c0c
SSDEEP 768:lZseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pparoUR:lZseJ3xWvhfynu1jaVcL88pRO
TLSH
T12ED20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C03C76EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 815bbd70094f4db0bd2cddf5fa54becb3c77c3bb788f2bb24e8c6dc50e54d266
MD5 4e1f7a99f9486f65fb9018e8258040b7
SHA1 969074cc44926dd7eb17a49d5905e5e6b39971da
SHA512 d96c45b0b56fb23fbb85e0e80de891ab814ccf9cd87d4c32b1851ea6f3bf1ea90a84183db9a3afc5b6954e891c1a892ef96e68133371f9861b0414478781ed69
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Em:KYHIhKggkXyBOIHKnq0jy9TINK4UIk
TLSH
T129911046343F130329BD2848A7A59D364E4171A37464A5BF7BB844A24E27E260DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5951ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5951ef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 67fed57b00762b064d2618af404f5883c2552ddfff30c87de192b43963a8376a
MD5 107332d3e2d95c9d3d71c750155a7b2f
SHA1 e4503bb8e01f428aa3223fe9885d81c2294a342a
SHA512 339c3ccaefd3e7abc78901c8107c7ffa6000f1a8bdbf16fa35c085cccd4c9e0c2525c6dbb0c0ab0143d2d752f768513ad65eca4fc776ba243278ece888bfd2aa
SSDEEP 192:utm+xasuheOwQxMGsN/jQVbeukRsM7pEmdQmiU1UfQn4MTKcCOxkk8z1EcqA6uBN:vZcIhsN/j0beukn7OmbUQ4xOxaEG6uD
TLSH
T115624C726C649C7B99E7F541F88A36131EB4D067D7C49E50E9EC7F1D00DB1A8130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a3868a4f81fa8d938bf8b20c79742cf2a26c446fc42ac9f1d3f3a4522e656ccd
MD5 1b6528e199b28893c908c57a8907d132
SHA1 a4fea86d678b24a3baa2de9ccdb642eb0442aeea
SHA512 72b7810d7e904e8b12b513e6d23d4261d3c99223692bc9ac57a340c070882323f80ab82b9dc5454d79a69aa83bf96b6b0c5bf013fabb0375e3a95d9c80bbd106
SSDEEP 384:IiFiZcIMzsNh8TUNTUlIlj0beukn7OmbaQ4xOxwEG6uD:TFQwcwgiUnYQ65E9uD
TLSH
T172B209F258D7883AD9AE9B43B77D2E024EBCC067B5849950B7D86B1CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c9944665409639cfdd11311a75deb54bbd37503fd65e2a4485eeb9369edad000
MD5 a1dc6e11d44cba5c49cdfeae19380890
SHA1 eef8670e25c45f9e17cbf732472f63356e9129b3
SHA512 f76eae69180dd7bcb6680ccdf7b14b66cca2174d3d55c27bb0ec78a1c9ae8dfc774d9bd7b695cd96572571c44d24f82cc02c3a3471b25fa9203a89b68027facb
SSDEEP 192:uGLsN/UQVbeukRsM7pEmdQmiU1UfQn4MTKcCOxkk8z1EcqA6UMZ:LsN/U0beukn7OmbUQ4xOxaEG6UMZ
TLSH
T18E420B76AC649C6B9DA3F551F48A36131FB4816BDAC46F50EADC6F1C00DF29C230A527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a019c62fd4089a4aab61a0a8ea8877cb6894ed70a68aa5901acc28f20236fb3
MD5 091e8a0b29e7ab970fbb49874abd5dd9
SHA1 57c4b3326567e86a94ed54828c84e733b0921a80
SHA512 49bf4e244c1531bafdcfb17699356bbecbd9db676e041fca9fb1c52cb56ffdd514e0d23b57f53e3d7e0ab2ba48632e6825bd5f4c96e5f96294bb0f644d175aaf
SSDEEP 192:lONx6vMtPQmiUyafThTKcCOxV84787U/u:lONx6UtRRTSOx1WU/u
TLSH
T17C020935FD786CBBDAA3AD46F48A27171FB051BBA5905B50EAE82F1C00D725C130792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 53fc91101d0c73e203a9a3fd648eba90d65024262b161cb30b38d5bcfa195e03
MD5 c4e01dc234e0a01ad73399059f00951d
SHA1 7637d58275c8335a7e62b9a2723920e805c940a5
SHA512 94bd898bd2531d731afd7bf65f137c22ef29106642e142ba438f0d06ecc9d2ebf832863814a11e1c4fd76b97fd4453564652e40e14dab7b7c528fde81f1bc476
SSDEEP 192:7ONC6vM2PQmiUyxfDhTKcCOxkx80IEcqA6U/u:7ONC6U2RsDSOxpEG6U/u
TLSH
T19B120A76BC649C6B9DA3B441F48A32171EB5816BDA84AB50EADC3F1C01EF55C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c37f96fce6ace6f950d8751e72ee22468c5749ae180537d2972a3396615b06a
MD5 4006d5b72f468fafcc75e499a77b117b
SHA1 edbe9e5870f24af1b589962c70c0f7f1b92274c1
SHA512 603987d54d8278fd9e08822c498fae0b69e6c7d4d7087782af7712d4da3dbdd218c77df2ad8a8a3d20f1f78e31302168be85b09f52f32c056439b3c428cebb6c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58fe41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fe41.TMP
Size 392B
SHA256 26829653ada75b9fac64f37a0d3917e301b4de0b2c56671660ca40166038f740
MD5 bf10c2ba7005472f4931b6e68288c5e5
SHA1 5b475a57fb1a612482196001ca55b146d31bad0e
SHA512 576d6e79220cdd36b7cc45fb44619c3273457b99c1fd24f0e008a894766d1ee5e84939732c416b4fe8bd7c9e947a198b0a01bdc7ed49933108c9dbf653c78740
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 218c0e9b716908256415c19a08a41752356b8f09a472ea5731c58f95003dec0e
MD5 d9934a70433bcb052c048b4b533cc6cf
SHA1 0b384e87f44d9175711af4d61b234669ab2d7649
SHA512 ee7aa073c24d6f644f6dce3d28d44d1f4a9b82839130c494420525c2699e91718daed1b6ce6af8bacb0f5b782fa1c48a39767a7a025827a9ac041248d56910d0
TLSH
T1DC515C133091997F250AA648E99405DBE97641F2EF33F8D20AF13D52C2546C14C9729E
MD5 SHA1 SHA512 TLSH

Submit Download

8ed4f739-bd87-4385-a851-4ad34a4a3696.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ed4f739-bd87-4385-a851-4ad34a4a3696.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e0e24855bdb39c157770d29df664f997d5464f31ea2c0250d66ac4b24c26b89
MD5 ce11fbde4e64c0c6fc2eee8aa8a60a7c
SHA1 f305498998eb5fb67f0d14b92740faf7a60a5bfe
SHA512 c5c666dbe1058853688be04c7957ae47b3b039679057675a49b7b70119d200c906616a686c17c366de02ab12c1ddd2f469c3984237954df915f5cb20b5d99aaf
TLSH
T11E412B5CAAFA1148B3B76F96ABF6646E447EBC372F16D45D00010E8E0A23A00D871B37
MD5 SHA1 SHA512 TLSH

Submit Download